ata-validator 1.22.0 → 1.23.0

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to ata-validator are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and this project adheres to semantic versioning.
 
+## 1.23.0 - 2026-09-16
+
+### Added
+
+- `strictSchema: true | 'log'`, and the compat shim's `strict`/`strictSchema` now enforce it: the authoring-time checks for the mistakes that fail open. An unknown keyword throws at construction with its path and the nearest known spelling, `strict mode: unknown keyword "maxLenght" (did you mean "maxLength"?) at #/properties/a/maxLenght`, and a local `$ref` that does not resolve in its own document throws instead of compiling a validator that rejects everything. `'log'` warns through the logger and continues. Off by default. The known-keyword list is derived from the vendored meta-schema documents rather than maintained by hand, plus the keywords ata implements beyond them; `x-` prefixed names and keywords registered through the `keywords` option pass. Property names, `enum` and `const` values, `default` and `examples` are data, not keywords, and the walk knows the difference, including the draft-07 `dependencies` form. `strictTypes`, `strictTuples` and `strictRequired` remain accepted and ignored, and `compat.d.ts` now says which is which. Reported as issue #44 by a migration that fuzzed 1,364 mutations against both validators, found zero divergence, and then shipped a typo.
+
+### Changed
+
+- The error and combined generators compile on the first rejection instead of at startup. Every schema compiled three functions eagerly: the verdict, the combined validate-and-collect form, and the error generator, which on a cold first call cost 8.2, 10.4 and 7.8 ms on a 120-property config schema, most of it V8 compiling each generator's own code the first time it is entered. A caller that never reads an error never needs the last two, and `validate()` on a passing document does not either, so they are built on the first rejection. Compile plus first verdict on that schema: 30.7 to 10.8 ms, interleaved runs of committed builds. The warm path measured the same on all ten cases checked. The shared compile cache keeps `undefined` meaning not built yet and `null` meaning the compiler declined, in both places that seed it, and `tests/test_compile_cache_order.js` caught the one seam where the two seeders disagreed during this change.
+- The static `unevaluatedProperties` tier stopped checking membership with a first-character switch. Keys sharing a first character, `ENV_0` through `ENV_999` say, all land in one case whose body chains every name, per key of the document: the `additionalProperties` quadratic in a different coat. Above 128 declared names the generated code reads the hoisted lookup that fixed the first one; below that the switch stays. A 1300-property config document with both of its objects closed: 87.7 to 24.5 µs, and the keyword now costs what `additionalProperties` costs, which is the membership test itself. Only the boolean generator has this code; the error and combined generators decline `unevaluated*` and the interpreted engine produces those errors.
+- The compat shim derives each error's pointer segments and kinds once, into a key map shared by the reference-order sort and the shaping loop. The sort comparator used to re-split and re-classify both errors' pointers on every one of its comparisons, and the loop derived the same segments again per error, with the `if` wrapper's flush doing it a third time. A seven-error rejection through `ata-validator/compat` with `allErrors`: 5.79 to 3.27 µs. The shim's own overhead over `Validator.validate` fell from 4.4 µs to 1.9. The compat surface is pinned by `test_compat`, 106 error-format cases, 36 parity cases and the error-shape differential, all green before and after.
+
+### Fixed
+
+- The API table said `verbose` attaches only `parentSchema`; it attaches `parentSchema`, `schema` and `data`, and the migration guide now lists which `params` key each keyword carries. The performance notes recorded "length-bucketed key comparison for `additionalProperties: false`" as measured and dropped on the grounds that each comparison is a pointer compare; that was right about one comparison and wrong about the total, and the note now carries the measurements that replaced it.
+
+## 1.22.1 - 2026-09-16
+
+### Fixed
+
+- `validateJSON()` did not return on a document that ends inside an array. `validateJSON('[')` was one byte, any schema, the default configuration, and it never came back. On a rejection the error carries a caret, so a map from pointer to position is built from the raw text; its array loop asked for the next element without checking that the input had ended, `walk` returned without moving, and nothing else could close the array. `'[}'` hung the same way, because a character that begins no value leaves the position where it was. The object loop escaped only by accident: an unterminated string throws, and `lib/data-position-cache.js` catches throws. It cannot catch a loop. Both container loops now stop at the end of the input, and the array loop stops when an iteration does not advance, so a truncated document still yields a map of what was there.
+  - A regression here is an infinite loop, which an ordinary test cannot report because it never reaches a failure. `tests/test_malformed_json_termination.js` runs its corpus in a child process under a watchdog, so a hang becomes a timeout and a red test. The corpus is every prefix of ten documents plus characters inserted where they cannot begin a value: 1793 inputs, 7172 verdicts. It was confirmed to fail before this change and pass after.
+  - `tests/fuzz_positions.js` had never fed malformed text to this walker; it fuzzes schema positions with `JSON.stringify` output, which is always well formed. Nothing else changes: on the same five-field schema, `validate()` on a valid document, `validate()` on an invalid one with the errors read, and `validateJSON()` on both are all within measurement noise of 1.22.0.
+
+- `unevaluatedProperties: false` reported the boolean schema underneath the keyword instead of the keyword itself: `keyword: 'not'`, empty `params`, and an `instancePath` pointing at the offending member rather than the object holding it. Nothing in that error said which key was unexpected, so a caller branching on `params.unevaluatedProperty` to flag unknown keys saw nothing at all. It now reports `unevaluatedProperties` on the object, with `params.unevaluatedProperty` naming the key, one error per key. `unevaluatedItems: false` had the same shape and now reports one error for the array, with `params.limit` at the first unevaluated position. Both engines were changed together and `tests/test_unevaluated_error_shape.js` holds them to it. Reported by a config linter reading `err.params.unevaluatedProperty` through `ata-validator/compat`.
+- `verbose: true` attached only `parentSchema`. It now also attaches `data`, the value the error points at, and `schema`, the failing keyword's own value, which is the whole set the option is supposed to carry. Without `data` a caller had to walk the document by the instance path itself. The default error shape is unchanged: the two fields appear only when `verbose` is on, including on the errors `ata-validator/compat` synthesises for an `if` wrapper.
+
+### Changed
+
+- `additionalProperties: false` no longer compiles to a comparison per declared name. It was one comparison per name per key of the document, which is quadratic in the number of properties: a 1000-property schema spent 75 µs on a document where the same schema without the keyword took 3, and doubling the properties quadrupled that. Above 128 declared names the generated code now reads a name lookup built once per compiled function; below that the comparison chain stays, because it allocates nothing and the two are the same within noise there.
+  - Cross-process medians, one variant per process, properties of type string: 250 names 8.76 µs to 5.49, 500 names 26.29 to 12.47. With no per-property work, so the membership test is all that is measured: 1000 names 77.3 µs to 18.1, 2000 names 273.6 to 38.9.
+  - Measured and not taken: `for...in` over the document instead of an indexed loop over `Object.keys` was about a quarter slower at every size, even though it allocates no key array.
+  - `tests/test_additional_properties_scaling.js` guards this structurally, on the emitted source: the lookup is present above the threshold, absent below it, and declared outside the function that runs per call. It asserts no timing, because a wall-clock ratio was not a guard here: the quadratic shape measured 7.7x for four times the properties on the machine the test was written on, where a CI runner measured 8.3x for the fixed code. The comparison chain short-circuits as soon as a key matches, so the ratio never separated the two. Found by a config linter whose schema is generated from a project's environment variables, so its property count is whatever the project has.
+
 ## 1.22.0 - 2026-09-14
 
 ### Fixed

package/README.md

@@ -1,6 +1,6 @@
 # ata-validator
 
-JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile your schemas to per-schema ESM modules with no validator dependency. `Validator<T>` composes with TypeBox, Zod-from-JSON-Schema, Valibot, or hand-written types. Runtime API available for dynamic schemas. Draft 2020-12, draft 7 and the [JSON Schema v1 dialect](#dialects).
+JSON Schema validation that compiles for speed and still runs where code generation is blocked. The compiled and interpreted engines answer identically, at 100% of the official suite in both modes, across Draft 2020-12, draft 7 and the [JSON Schema v1 dialect](#dialects). First-class TypeScript inference, and `ata build` emits a standalone module that imports nothing.
 
 [![npm](https://img.shields.io/npm/v/ata-validator)](https://www.npmjs.com/package/ata-validator)
 [![License](https://img.shields.io/npm/l/ata-validator)](LICENSE)
@@ -97,6 +97,55 @@ run on the interpreted engine. That engine compiles each schema into a tree of c
 on a six-field object schema a passing payload costs about 136 ns against 8 ns for the same
 shape on the compiled path, both measured warm in one run on the same machine.
 
+## Schemas and models
+
+If you ask a model for structured output and validate the result, the schema is
+part of the prompt and the validation error is part of the retry. Two functions
+produce those strings.
+
+```js
+import { describeSchema, toRetryMessage, Validator } from 'ata-validator'
+
+describeSchema(schema)
+// output: object
+//   status: one of "AWAITING_CLEARANCE", "PART_SETTLED", "CLOSED_OUT"
+//   region_code: one of "R11", "R24", "R37", "R52"
+//   amount: integer, at least 1
+//   no other fields
+
+const r = new Validator(schema).validate(fromTheModel)
+if (!r.valid) toRetryMessage(r.errors)
+// /status: expected one of ["AWAITING_CLEARANCE", "PART_SETTLED", "CLOSED_OUT"], found "partial"
+// /region_code: expected one of ["R11", "R24", "R37", "R52"], found "HH"
+// /amount: expected ≥1, found 0
+// /: unknown property "extra"
+```
+
+Whether this is worth anything depends on the schema, and the measurement that
+says so is
+[public](https://github.com/mertcanaltin/retry-message-experiment), with the
+harness and the raw results.
+
+On constraints a model can work out from the document, a pattern, a date format,
+a currency in uppercase, it changes nothing: 40 of 40 documents recovered on one
+retry with the conventional error text, and 40 of 40 with the detailed one.
+
+On constraints it cannot work out, an `enum` of internal codes while the
+document says "paid in part" and "Hamburg office", the conventional text
+recovered 0 of 30 and the detailed text 30 of 30. The model does not give up
+when it is not told the values, it invents plausible ones, so no number of
+retries closes it.
+
+Stating the constraints up front does the same job earlier. Across four prompts
+on the same fixtures, first attempts that validate: nothing 0 of 30, a lean
+field list 0 of 30, a careful hand-written description 30 of 30 on the inferable
+fixture and 0 of 30 on the opaque one, and `describeSchema` 30 and 23. A person
+writing prose matches the generated description wherever prose works. It is the
+enumerated values a person leaves out.
+
+One model, Claude Haiku 4.5, one schema shape, 30 to 40 documents per arm, no
+temperature control. Read it as a finding, not a law.
+
 ## Error messages
 
 ata's error output is compiler-grade: each error carries a stable code, an inline source frame pointing at the schema file, and another pointing at the offending bytes in the request payload. Renderers ship in three styles:
@@ -153,6 +202,33 @@ Schemas without an `errorMessage` keyword pay nothing: the override pass is only
 
 For consumers who built log dashboards on the v0.14 error shape, `new Validator(schema, { richErrors: false })` returns the legacy shape exactly. For high-throughput paths, `abortEarly: true` continues to short-circuit; the returned error carries `code: 'ATA9000'` and no enrichment.
 
+## Which path, and where
+
+There are two ways to run ata and they suit different places. Measuring the wrong one
+is the most common way to get a misleading number out of this library.
+
+| | compiled with `ata build` | runtime `new Validator(schema)` |
+|---|---|---|
+| In a bundle, gzipped | **1.9 KB** | 75.6 KB |
+| Time to a served request | **3.5 ms** | 10.7 ms |
+| Schema known when | build time | any time |
+
+The bundle row is a ten-field user schema built with
+`bun build --minify --target=browser`. The startup row is a Hono route on Bun 1.4, best
+of seven, against 3.6 ms for the same app doing no validation at all, so the compiled
+path costs nothing measurable to start. The runtime
+figure is what it is because a schema that arrives at run time can use any keyword, so
+the whole engine has to be there. The compiled module imports nothing and contains only
+the checks your schema asks for.
+
+**On a server, use whichever fits your schemas.** 76 KB of JavaScript on a Node or Bun
+process is not a cost anyone notices, and the runtime API is the simpler thing to reach
+for. Speed is the same either way once warm.
+
+**In a browser, on an edge runtime, or anywhere cold starts are charged, compile.** This
+is where the difference is the whole story, and it is also where `new Function` is often
+blocked outright, which the compiled module does not need.
+
 ## When to use the runtime API instead
 
 `ata build` is for schemas you know at build time. If your schemas are user-supplied at runtime (form builders, no-code platforms, dynamic API ingestion), use the runtime API:
@@ -374,7 +450,7 @@ const v = new Validator(schema, {
 
 ### Build-time compile (`ata compile`)
 
-The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. Typical output is ~1 KB gzipped compared to ~65 KB for the full runtime bundled for the browser.
+The `ata` CLI turns a JSON Schema file into a self-contained JavaScript module. No runtime dependency on `ata-validator`, so only the generated validator ships to the browser. Typical output is about 2 KB gzipped for a ten-field schema, against 74 KB for the runtime bundled for the browser.
 
 ```bash
 npx ata compile schemas/user.json -o src/generated/user.validator.mjs
@@ -404,7 +480,7 @@ CLI options:
 | `-o, --output <file>` | `<schema>.validator.mjs` | Output path |
 | `-f, --format <fmt>` | `esm` | `esm` or `cjs` |
 | `--name <TypeName>` | from filename | Root type name in the `.d.ts` |
-| `--abort-early` | off | Generate the stub-error variant (~0.5 KB gzipped) |
+| `--abort-early` | off | Generate the stub-error variant, about a third of the source |
 | `--no-types` | off | Skip the `.d.mts` / `.d.cts` output |
 
 For a project with many schemas, `ata build <glob>` compiles them all in one command:
@@ -415,13 +491,19 @@ npx ata build 'schemas/*.json' --out-dir build/validators --check
 
 Run with `--watch` during development for incremental rebuilds.
 
-Typical bundle sizes (10-field user schema, gzipped):
+Bundle sizes for a 10-field user schema, minified and gzipped, measured with
+`bun build --minify --target=browser`:
 
-| Variant | Size | Notes |
+| What the app imports | Size | Notes |
 |---|---|---|
-| `ata-validator` runtime | ~27 KB | Full compiler + all keywords |
-| `ata compile` (standard) | **~1.1 KB** | Validator + detailed error collector |
-| `ata compile --abort-early` | **~0.5 KB** | Validator + stub errors only |
+| `Validator` from `ata-validator` | 74.1 KB | The compiler ships with it, because a runtime schema can use any keyword |
+| `isValid` from the compiled module | **1.9 KB** | Nothing else is reachable, so the error collector is dropped |
+| `validate` from the compiled module | **3.6 KB** | Adds the detailed error collector |
+
+`--abort-early` makes the generated source about three times smaller, and after
+bundling it makes no difference: importing only `isValid` already leaves the error
+collector unreachable, and a bundler drops it. Use the flag to cut the file on disk,
+not to cut what ships.
 
 Programmatic API if you prefer to script it:
 

package/compat.d.ts

@@ -78,10 +78,15 @@ declare namespace Ata {
     formats?: Record<string, Format>;
     keywords?: KeywordDefinition[];
     schemas?: object[] | Record<string, object>;
+    /** Enforced: unknown keywords and dangling local $refs throw at compile ('log' warns instead). */
     strict?: boolean | 'log';
+    /** Same checks as `strict`; the specific option wins over the umbrella one. */
     strictSchema?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictTypes?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictTuples?: boolean | 'log';
+    /** Accepted for API compatibility; not enforced. */
     strictRequired?: boolean | 'log';
     allowUnionTypes?: boolean;
     logger?: { log(...args: unknown[]): void; warn(...args: unknown[]): void; error(...args: unknown[]): void } | false;

package/compat.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { resolvePointer } = require('./lib/pointer.js');
+
 // Drop-in for the default validator's class. `const Ajv = require('ata-validator/compat')`
 // and the rest of the file stays as it was: `new Ajv(opts)`, `compile`,
 // `validate`, `addSchema`, `getSchema`, `removeSchema`, `addFormat`,
@@ -13,8 +15,10 @@
 //   - `$data` references;
 //   - keywords defined only through `code` (a code generator hook);
 //   - the reference formats plugin, whose formats are built in here.
-// Strict-mode schema checks (`strict`, `strictTypes`, ...) are accepted and
-// ignored: an unknown keyword is an annotation, as the specification says.
+// Strict-mode schema checks: `strict` and `strictSchema` are enforced for the
+// checks that fail open, an unknown keyword (`maxLenght` compiles and the
+// constraint is simply absent) and a dangling local `$ref`. `strictTypes`,
+// `strictTuples` and `strictRequired` are accepted and ignored.
 
 const { Validator } = require('./index');
 const { METASCHEMAS } = require('./lib/metaschemas');
@@ -97,6 +101,13 @@ class Ata {
       removeAdditional: !!o.removeAdditional,
       verbose: !!o.verbose,
     };
+    // `strict` and `strictSchema`: the unknown-keyword and dangling-local-$ref
+    // checks are enforced; `strictTypes`, `strictTuples` and `strictRequired`
+    // are still accepted and ignored. The specific keyword option wins over
+    // the umbrella one, which is how the reference class reads them.
+    const strictness = o.strictSchema !== undefined ? o.strictSchema : o.strict;
+    if (strictness === true || strictness === 'log') out.strictSchema = strictness;
+    if (o.logger !== undefined) out.logger = o.logger;
     if (o.validateFormats === false) out.assertFormat = false;
     const formatNames = Object.keys(this._formats);
     if (formatNames.length > 0) out.formats = { ...this._formats };
@@ -174,7 +185,16 @@ class Ata {
         validate.errors = null;
         return true;
       }
-      const errors = shaper === null ? result.errors : shaper(result.errors, data);
+      let errors = shaper === null ? result.errors : shaper(result.errors, data);
+      // Errors the shaper synthesises, the `if` wrapper among them, are built
+      // from the group rather than carried up from the validator, so verbose
+      // mode has to fill in the value they point at here or they would be the
+      // only ones missing it.
+      if (this.opts.verbose) {
+        errors = errors.map((e) => (e && !('data' in e)
+          ? { ...e, data: resolvePointer(data, e.instancePath || '', undefined) }
+          : e));
+      }
       validate.errors = shaper === null && !allErrors ? errors.slice(0, 1) : errors;
       return false;
     };

package/index.d.ts

@@ -72,6 +72,37 @@ export function renderPretty(errors: RichValidationError[], opts?: PrettyOptions
 export function renderCompact(errors: RichValidationError[], opts?: CompactOptions): string;
 export function renderJSON(errors: RichValidationError[], opts?: JSONRenderOptions): string;
 
+/** Options for {@link describeSchema}. */
+export interface DescribeSchemaOptions {
+  /** What to call the top level in the description. Defaults to `output`. */
+  name?: string;
+}
+
+/**
+ * The schema's constraints as prose, for the prompt that asks a model to
+ * produce a document. Values a model cannot infer, an `enum` of internal codes
+ * most of all, are the ones worth stating: measured on one fixture, naming them
+ * took first-attempt validity from 0 of 30 to 23 of 30, where a careful
+ * hand-written description scored 0 on exactly those fields.
+ * https://github.com/mertcanaltin/retry-message-experiment
+ */
+export function describeSchema(schema: object, opts?: DescribeSchemaOptions): string;
+
+/** Options for {@link toRetryMessage}. */
+export interface RetryMessageOptions {
+  /** Most errors to include. Defaults to 20, because a model does not act on a long list. */
+  limit?: number;
+}
+
+/**
+ * The errors as a string to send back to a model, naming what was expected and
+ * what arrived. On constraints a model can infer from context this changes
+ * nothing; where a constraint is an internal vocabulary it was the difference
+ * between 0 of 30 and 30 of 30 recovered on one retry.
+ * https://github.com/mertcanaltin/retry-message-experiment
+ */
+export function toRetryMessage(errors: RichValidationError[], opts?: RetryMessageOptions): string;
+
 /** A user-supplied format checker. Receives the candidate value, returns true if valid. */
 export type FormatChecker = (value: string) => boolean;
 

package/index.js

@@ -885,6 +885,29 @@ class Validator {
     // produced the error). Matches ajv's `verbose: true` behavior.
     this._verbose = !!options.verbose;
 
+    // strictSchema: authoring-time checks, off by default. A mistyped keyword
+    // is the one schema mistake that fails open: to every dialect `maxLenght`
+    // is an annotation, so the constraint the author meant is simply absent
+    // and previously invalid data validates. `true` throws here, at
+    // construction, with every finding; `'log'` reports through
+    // `options.logger` or the console and continues. The check runs on the
+    // schema as written, before any normalization touches it.
+    if (options.strictSchema === true || options.strictSchema === 'log') {
+      const { checkSchemaStrict } = require('./lib/strict-check');
+      const problems = checkSchemaStrict(schema, { userKeywords: options.keywords || null });
+      if (problems.length > 0) {
+        const text = problems.map((x) => `strict mode: ${x.message} at ${x.path}`).join('\n');
+        if (options.strictSchema === true) {
+          throw new Error(text);
+        }
+        const logger = options.logger;
+        if (logger !== false) {
+          const warn = logger && typeof logger.warn === 'function' ? logger.warn.bind(logger) : console.warn;
+          warn(text);
+        }
+      }
+    }
+
     // richErrors: default true. Only the literal `false` opts back into the
     // v0.14 error shape (no code/expected/received/docUrl, no aliases).
     this._richErrors = options && options.richErrors === false ? false : true;
@@ -1014,27 +1037,40 @@ class Validator {
     // because nothing has tried to build them yet. Both halves of that
     // distinction are null, and reading the second as the first costs this
     // schema its generated error function for the life of the process.
-    } else if (cached && cached.full && !_forceNapi) {
+    } else if (cached && cached.jsFn !== undefined && !_forceNapi) {
+      // `full` says the error and combined functions exist too. An entry
+      // without it still carries a verdict function worth reusing; the pair is
+      // built by _buildDeferred below if something asks for an error, and the
+      // entry is upgraded then. `undefined` in `combined`/`errFn` means not
+      // built yet; `null` means the compiler declined. Those two must never
+      // blur: reading the first as the second is the bug this cache had once
+      // already, and it silently cost schemas their generated error function.
       jsFn = cached.jsFn;
       jsCombinedFn = cached.combined;
       jsErrFn = cached.errFn;
       _isCodegen = !!cached.isCodegen;
+      this._engine = _isCodegen ? 'codegen' : jsFn ? 'closure' : null;
     } else if (!_forceNapi) {
       const uf = this._userFormats;
       const _cgFn = compileToJSCodegen(schemaObj, sm, uf);
       jsFn = _cgFn || compileToJS(schemaObj, null, sm);
-      jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, uf);
-      jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, uf);
+      // Only the verdict is compiled here. The error and combined generators
+      // are the other two thirds of a cold first call (8.2, 10.4 and 7.8 ms on
+      // a 120-property config schema, most of it V8 compiling each generator
+      // the first time it is entered), and a caller that never reads an error
+      // never needs them. _buildDeferred compiles them on the first rejection.
+      jsCombinedFn = undefined;
+      jsErrFn = undefined;
       _isCodegen = !!_cgFn;
       this._engine = _cgFn ? 'codegen' : jsFn ? 'closure' : null;
       if (!uf) {
-        _compileCache.set(mapKey, { jsFn, combined: jsCombinedFn, errFn: jsErrFn, isCodegen: _isCodegen, full: true });
+        _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: _isCodegen, full: false });
       }
     } else {
       jsFn = null; jsCombinedFn = null; jsErrFn = null;
     }
     this._jsFn = jsFn;
-    if (this._engine === undefined) this._engine = (cached && cached.full) ? (cached.isCodegen ? 'codegen' : jsFn ? 'closure' : null) : null;
+    if (this._engine === undefined) this._engine = null;
 
     // Data mutators -- try codegen first (12x faster), fallback to closure arrays.
     // Follow cross-refs so coercion/defaults/removeAdditional see the referenced
@@ -1080,14 +1116,26 @@ class Validator {
           )));
     const useSimdjsonForLarge = !hasArrayTraversal;
 
-    if (jsFn) {
-      let safeErrFn = null;
-      if (jsErrFn) {
-        try {
-          jsErrFn({}, true);
-          safeErrFn = (d) => jsErrFn(d, true);
-        } catch {}
+    // Builds the two generators the compile step left out, once, and upgrades
+    // the shared cache entry. `undefined` means not built yet; `null` means the
+    // compiler declined. Conflating those is what once cost every schema its
+    // generated error function for the life of the process, so they stay apart.
+    const _buildDeferred = () => {
+      if (jsCombinedFn !== undefined && jsErrFn !== undefined) return;
+      const uf2 = this._userFormats;
+      if (jsCombinedFn === undefined) jsCombinedFn = compileToJSCombined(schemaObj, VALID_RESULT, sm, uf2) || null;
+      if (jsErrFn === undefined) jsErrFn = compileToJSCodegenWithErrors(schemaObj, sm, uf2) || null;
+      if (!uf2) {
+        const entry = _compileCache.get(mapKey);
+        if (entry && entry.jsFn === jsFn) {
+          entry.combined = jsCombinedFn;
+          entry.errFn = jsErrFn;
+          entry.full = true;
+        }
       }
+    };
+
+    if (jsFn) {
       // errFn: use JS codegen if safe, else native fallback (only when native
       // is available). Environments without the native addon — Cloudflare
       // Workers, browser, Bun without N-API — get a JS-only fallback so the
@@ -1126,19 +1174,38 @@ class Validator {
       // reports those schemas correctly, so failing data is re-validated
       // there. This used to be a placeholder error with no keyword and no
       // path, which hid whatever had actually failed.
-      const errFn =
-        safeErrFn ||
-        (hasUnevaluated || !native
-          ? jsOnlyFallback
-            : hasDynRef
-              ? (d) => {
-                  this._ensureNative();
-                  return this._compiled.validateJSON(JSON.stringify(d));
-                }
-              : (d) => {
-                  this._ensureNative();
-                  return this._compiled.validate(d);
-                });
+      // Resolved on the first rejection rather than at compile time, because
+      // building the generator behind it is two thirds of what a first call
+      // costs and a caller that never reads an error never needs it. The probe
+      // moves here with it: it calls the generated function, so it cannot run
+      // before the function exists.
+      let _errOnlyImpl = null;
+      const errOnly = (d) => {
+        if (_errOnlyImpl === null) {
+          _buildDeferred();
+          let safe = null;
+          if (jsErrFn) {
+            try {
+              jsErrFn({}, true);
+              safe = (x) => jsErrFn(x, true);
+            } catch {}
+          }
+          _errOnlyImpl =
+            safe ||
+            (hasUnevaluated || !native
+              ? jsOnlyFallback
+                : hasDynRef
+                  ? (x) => {
+                      this._ensureNative();
+                      return this._compiled.validateJSON(JSON.stringify(x));
+                    }
+                  : (x) => {
+                      this._ensureNative();
+                      return this._compiled.validate(x);
+                    });
+        }
+        return _errOnlyImpl(d);
+      };
 
       // Best path: combined validator (single pass, validates + collects errors)
       // Valid data: returns VALID_RESULT, no allocation
@@ -1148,24 +1215,41 @@ class Validator {
       // Test combined at compile time -- some schemas (e.g. if/then/else)
       // produce broken combined code that crashes on certain inputs.
       // We probe with diverse data; if any throws, fall back to hybrid.
-      let safeCombinedFn = null;
-      if (jsCombinedFn) {
-        try {
-          const probe = {};
-          // Populate probe with one key per known property to trigger nested paths
-          if (schemaObj && schemaObj.properties) {
-            for (const k of Object.keys(schemaObj.properties)) probe[k] = "";
-          }
-          if (schemaObj && schemaObj.if && schemaObj.if.properties) {
-            for (const k of Object.keys(schemaObj.if.properties)) probe[k] = "";
-          }
-          jsCombinedFn(probe);
-          jsCombinedFn({});
-          jsCombinedFn(null);
-          jsCombinedFn(0);
-          safeCombinedFn = jsCombinedFn;
-        } catch {}
-      }
+      let _combinedProbed = false;
+      let _safeCombined = null;
+      const combinedIfSafe = () => {
+        if (_combinedProbed) return _safeCombined;
+        _combinedProbed = true;
+        _buildDeferred();
+        if (jsCombinedFn) {
+          try {
+            const probe = {};
+            // Populate probe with one key per known property to trigger nested paths
+            if (schemaObj && schemaObj.properties) {
+              for (const k of Object.keys(schemaObj.properties)) probe[k] = "";
+            }
+            if (schemaObj && schemaObj.if && schemaObj.if.properties) {
+              for (const k of Object.keys(schemaObj.if.properties)) probe[k] = "";
+            }
+            jsCombinedFn(probe);
+            jsCombinedFn({});
+            jsCombinedFn(null);
+            jsCombinedFn(0);
+            _safeCombined = jsCombinedFn;
+          } catch {}
+        }
+        return _safeCombined;
+      };
+
+      // What the hybrid path hands to its error slot: the combined function
+      // when it is usable, since it validates and collects in one pass, and
+      // the error generator otherwise. Same order the eager code chose, just
+      // chosen on the first rejection.
+      let _errPreferredImpl = null;
+      const errPreferCombined = (d) => {
+        if (_errPreferredImpl === null) _errPreferredImpl = combinedIfSafe() || errOnly;
+        return _errPreferredImpl(d);
+      };
 
       // The boolean engine is the verdict authority for these paths; the
       // final lazy wrapper uses it to skip error construction entirely.
@@ -1182,7 +1266,7 @@ class Validator {
           : (data) => (_fn(data) ? VALID_RESULT : ABORT_EARLY_RESULT);
       } else if (hasDynRef && _isCodegen && jsFn) {
         // $dynamicRef with JS codegen: direct path, no wrapper layers
-        const _fn = jsFn, _efn = safeErrFn || errFn, _R = VALID_RESULT;
+        const _fn = jsFn, _efn = errOnly, _R = VALID_RESULT;
         this.validate = preprocess
           ? (data) => { preprocess(data); return _fn(data) ? _R : _efn(data); }
           : (data) => _fn(data) ? _R : _efn(data);
@@ -1207,45 +1291,60 @@ class Validator {
       } else if (jsFn && jsFn._hybridFactory) {
         // Zero-wrapper: hybridFactory bakes VALID_RESULT + errFn into a single function
         // No arrow function wrapper, no ternary, one function call
-        const hybridFn = jsFn._hybridFactory(VALID_RESULT, safeCombinedFn || errFn);
+        // The factory bakes the error function in as an argument and never
+        // calls it for a document that passes, so a resolver here costs the
+        // accepted path nothing and keeps the compile off the first call.
+        const hybridFn = jsFn._hybridFactory(VALID_RESULT, errPreferCombined);
         this.validate = preprocess
           ? (data) => { preprocess(data); return hybridFn(data); }
           : hybridFn;
-      } else if (safeCombinedFn) {
-        this.validate = preprocess
-          ? (data) => { preprocess(data); return safeCombinedFn(data); }
-          : safeCombinedFn;
       } else {
-        const hybridFn = jsFn && jsFn._hybridFactory
-          ? jsFn._hybridFactory(VALID_RESULT, errFn)
-          : null;
-        this.validate = hybridFn
-          ? preprocess
+        // No hybrid factory, so the assembly needs the function itself rather
+        // than a reference it can call later: build it now.
+        const safeCombinedFn = combinedIfSafe();
+        if (safeCombinedFn) {
+          this.validate = preprocess
+            ? (data) => { preprocess(data); return safeCombinedFn(data); }
+            : safeCombinedFn;
+        } else {
+          this.validate = preprocess
             ? (data) => {
                 preprocess(data);
-                return hybridFn(data);
+                return jsFn(data) ? VALID_RESULT : errOnly(data);
               }
-            : hybridFn
-          : preprocess
-            ? (data) => {
-                preprocess(data);
-                return jsFn(data) ? VALID_RESULT : errFn(data);
-              }
-            : (data) => (jsFn(data) ? VALID_RESULT : errFn(data));
+            : (data) => (jsFn(data) ? VALID_RESULT : errOnly(data));
+        }
       }
-      // Verbose mode: populate parentSchema on each error.
-      // Errors may be frozen, so clone them with the extra field.
+      // Verbose mode: populate parentSchema, schema and data on each error, the
+      // three fields the default error shape carries under the same option.
+      // `data` is the value the error points at; without it a caller has to
+      // walk the document by the instance path itself, which is what one
+      // migration ended up writing by hand. Errors may be frozen, so clone
+      // them with the extra fields.
       if (this._verbose) {
         const inner = this.validate;
         const root = this._schemaObj;
+        const { resolvePointer } = require('./lib/pointer.js');
         this.validate = (data) => {
           const result = inner(data);
           if (result && !result.valid && result.errors) {
-            const enriched = result.errors.map((err) =>
-              err && err.parentSchema === undefined
-                ? { ...err, parentSchema: resolveSchemaByPath(root, err.schemaPath) }
-                : err
-            );
+            const enriched = result.errors.map((err) => {
+              if (!err || err.parentSchema !== undefined) return err;
+              const parentSchema = resolveSchemaByPath(root, err.schemaPath);
+              // The last segment of the schema path is the keyword that
+              // failed, so its value on the parent is that keyword's schema.
+              const sp = typeof err.schemaPath === 'string' ? err.schemaPath : '';
+              const last = sp.slice(sp.lastIndexOf('/') + 1).replace(/~1/g, '/').replace(/~0/g, '~');
+              const keywordSchema = (parentSchema !== null && typeof parentSchema === 'object' && last)
+                ? parentSchema[last]
+                : undefined;
+              return {
+                ...err,
+                parentSchema,
+                schema: keywordSchema,
+                data: resolvePointer(data, err.instancePath, undefined),
+              };
+            });
             return { valid: false, errors: enriched };
           }
           return result;
@@ -1257,12 +1356,15 @@ class Validator {
       this.isValidObject = preprocess
         ? (data) => { preprocess(data); return jsFn(data) }
         : jsFn;
+      // Same preference as the object path: the combined function first, since
+      // it validates and collects in one pass, and the error generator behind
+      // it. `errPreferCombined` is that order, resolved on the first rejection
+      // instead of at compile time.
       const hybridFn = jsFn._hybridFactory
-        ? jsFn._hybridFactory(VALID_RESULT, errFn)
+        ? jsFn._hybridFactory(VALID_RESULT, errPreferCombined)
         : null;
-      const jsonValidateInner = safeCombinedFn
-        || hybridFn
-        || ((obj) => (jsFn(obj) ? VALID_RESULT : errFn(obj)));
+      const jsonValidateInner = hybridFn
+        || ((obj) => (jsFn(obj) ? VALID_RESULT : errPreferCombined(obj)));
       // Parsed text takes the same preprocess pass as a parsed object, so
       // validate(obj) and validateJSON(text) answer the same for the same
       // document. Without it, coercion, removal and defaults applied on one
@@ -1782,15 +1884,20 @@ class Validator {
       return;
     }
     const uf = this._userFormats;
-    const jsFn = compileToJSCodegen(this._schemaObj, sm, uf) || compileToJS(this._schemaObj, null, sm);
+    const _cg = compileToJSCodegen(this._schemaObj, sm, uf);
+    const jsFn = _cg || compileToJS(this._schemaObj, null, sm);
     this._jsFn = jsFn;
     if (jsFn) {
       this.isValidObject = jsFn;
       // A partial entry: the verdict function is real, the other two are not
-      // built yet rather than declined. `full: false` says so, so the next
-      // caller that needs errors compiles them instead of inheriting nulls.
+      // built yet rather than declined. `undefined` is the not-built marker
+      // the full compile's _buildDeferred looks for; `null` would read as
+      // "the compiler declined" and cost the schema its error function, which
+      // is the bug this cache had once already. `isCodegen` rides along so a
+      // validator that later reuses this entry reports the same engine it
+      // would have compiled to.
       if (!uf) {
-        if (!cached) _compileCache.set(mapKey, { jsFn, combined: null, errFn: null, full: false });
+        if (!cached) _compileCache.set(mapKey, { jsFn, combined: undefined, errFn: undefined, isCodegen: !!_cg, full: false });
         else cached.jsFn = jsFn;
       }
     }

package/lib/compat-errors.js

@@ -49,7 +49,14 @@ function pointerOf(schemaPath) {
 }
 
 function segments(pointer) {
-  return pointer === '' ? [] : pointer.split('/').slice(1);
+  // split-then-slice built two arrays per call, and this is called for every
+  // error's pointer and every pointer walk. Dropping everything before the
+  // first '/' first builds one. Same answer for every input shape, including
+  // a pointer with no slash at all, which the old form turned into [].
+  if (pointer === '') return [];
+  const i = pointer.indexOf('/');
+  if (i < 0) return [];
+  return pointer.slice(i + 1).split('/');
 }
 
 // Walks a pointer's segments and reports, per position, whether that segment
@@ -67,24 +74,41 @@ function classify(segs) {
   return kinds;
 }
 
-function compareReferenceOrder(a, b) {
-  const pa = segments(pointerOf(a.schemaPath || ''));
-  const pb = segments(pointerOf(b.schemaPath || ''));
-  const ka = classify(pa);
-  const n = Math.min(pa.length, pb.length);
-  for (let i = 0; i < n; i++) {
-    if (pa[i] === pb[i]) continue;
-    if (ka[i] !== 'kw') return 0;
-    const ra = REFERENCE_RANK.get(pa[i]);
-    const rb = REFERENCE_RANK.get(pb[i]);
-    if (ra === undefined || rb === undefined) return 0;
-    return ra - rb;
-  }
-  return 0;
+// One derived key per error: its pointer relative to the hash, the split
+// segments, and each segment's kind. Everything below used to re-derive these
+// wherever it needed them, which for one shaped rejection meant splitting the
+// same pointer three times per error.
+function keyFor(e) {
+  const rel = pointerOf(e && e.schemaPath ? e.schemaPath : '#');
+  const segs = segments(rel);
+  return { rel, segs, kinds: classify(segs) };
+}
+
+function sortByKeys(errors, keys) {
+  if (errors.length < 2) return errors.slice();
+  const keyed = errors.map((e) => ({ e, k: keys.get(e) }));
+  keyed.sort((A, B) => {
+    const pa = A.k.segs, pb = B.k.segs, ka = A.k.kinds;
+    const n = Math.min(pa.length, pb.length);
+    for (let i = 0; i < n; i++) {
+      if (pa[i] === pb[i]) continue;
+      if (ka[i] !== 'kw') return 0;
+      const ra = REFERENCE_RANK.get(pa[i]);
+      const rb = REFERENCE_RANK.get(pb[i]);
+      if (ra === undefined || rb === undefined) return 0;
+      return ra - rb;
+    }
+    return 0;
+  });
+  for (let i = 0; i < keyed.length; i++) keyed[i] = keyed[i].e;
+  return keyed;
 }
 
 function sortLikeReference(errors) {
-  return errors.length < 2 ? errors : errors.slice().sort(compareReferenceOrder);
+  if (errors.length < 2) return errors;
+  const keys = new Map();
+  for (const e of errors) keys.set(e, keyFor(e));
+  return sortByKeys(errors, keys);
 }
 
 function walkPointer(node, pointer) {
@@ -151,14 +175,16 @@ function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors,
   // `basePointer` is where `errors` were produced relative to the root
   // document; a branch validator reports paths relative to its branch.
   function shape(errors, data, basePointer) {
-    const sorted = sortLikeReference(errors);
+    const keys = new Map();
+    for (const e of errors) keys.set(e, keyFor(e));
+    const sorted = sortByKeys(errors, keys);
     const out = [];
     const consumed = new Set();
     let thenGroup = null; // { prefix, which } for the pending `if` wrapper
 
     const flushIf = (e) => {
       if (thenGroup === null) return;
-      const segs = segments(pointerOf(e ? e.schemaPath : ''));
+      const segs = e ? keys.get(e).segs : [];
       const still = e && segs.length > thenGroup.depth && segs[thenGroup.depth] === thenGroup.which &&
         segs.slice(0, thenGroup.depth).join('/') === thenGroup.prefixSegs;
       if (still) return;
@@ -170,10 +196,11 @@ function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors,
     for (let idx = 0; idx < sorted.length; idx++) {
       const e = sorted[idx];
       if (consumed.has(e)) continue;
-      const rel = pointerOf(e.schemaPath || '#');
+      const K = keys.get(e);
+      const rel = K.rel;
       const abs = basePointer + rel;
-      const segs = segments(rel);
-      const kinds = classify(segs);
+      const segs = K.segs;
+      const kinds = K.kinds;
       const schemaPrefix = (e.schemaPath || '#').slice(0, (e.schemaPath || '#').indexOf('#') + 1);
 
       if (allErrors) flushIf(e);
@@ -234,7 +261,7 @@ function createShaper({ Validator, rootId, rootDoc, schemas, options, allErrors,
           // instance is replaced by the regenerated sequence.
           for (let j = idx; j < sorted.length; j++) {
             const o = sorted[j];
-            if ((o.instancePath || '') === (e.instancePath || '') && pointerOf(o.schemaPath || '#').startsWith(pnPointer + '/')) consumed.add(o);
+            if ((o.instancePath || '') === (e.instancePath || '') && keys.get(o).rel.startsWith(pnPointer + '/')) consumed.add(o);
           }
           const pnSchemaPath = schemaPrefix + pnPointer;
           for (const name of Object.keys(object)) {

package/lib/data-positions.js

@@ -63,6 +63,10 @@ function buildDataPositionMap (input) {
       i++;
       while (true) {
         skipWs();
+        // The input is not required to be valid JSON: this map is built to
+        // put a caret on a syntax error, so a document that stops in the
+        // middle of a container is the normal case, not an impossible one.
+        if (i >= n) break;
         if (text.charCodeAt(i) === 0x7d) { i++; break; }
         if (text.charCodeAt(i) === 0x2c) { i++; continue; }
         skipWs();
@@ -88,9 +92,15 @@ function buildDataPositionMap (input) {
       let idx = 0;
       while (true) {
         skipWs();
+        if (i >= n) break;
         if (text.charCodeAt(i) === 0x5d) { i++; break; }
         if (text.charCodeAt(i) === 0x2c) { i++; continue; }
+        const before = i;
         walk(path.concat([String(idx)]));
+        // A character that begins no value at all, a stray `}` for instance,
+        // leaves the position where it was, and a loop that does not advance
+        // does not end. `validateJSON('[')` hung here on one byte.
+        if (i === before) break;
         idx++;
       }
     } else if (ch === 0x22) {

package/lib/enrich-error.js

@@ -219,6 +219,12 @@ function enrich (rawErr, opts) {
     parentSchema: rawErr.parentSchema,
   };
 
+  // Verbose mode's two other fields. Carried only when the raw error has them,
+  // so the default error shape does not grow two undefined keys for everyone
+  // who never asked for verbose.
+  if ('data' in rawErr) out.data = rawErr.data;
+  if ('schema' in rawErr) out.schema = rawErr.schema;
+
   // oneOf/anyOf collapse: preserve the nested branch errors so the pretty
   // renderer can surface the closest variant's diagnostics.
   if (rawErr.branchErrors) out.branchErrors = rawErr.branchErrors;

package/lib/interpreter.js

@@ -461,6 +461,11 @@ class Plan {
 
     this.unevaluatedProperties = schema.unevaluatedProperties !== undefined ? child(schema.unevaluatedProperties) : undefined;
     this.unevaluatedItems = schema.unevaluatedItems !== undefined ? child(schema.unevaluatedItems) : undefined;
+    // A `false` here rejects the member outright, and the error belongs to this
+    // keyword on this object, not to a boolean schema that happens to sit
+    // under it. Recorded at compile time so the check below is one test.
+    this.unevaluatedPropertiesFalse = schema.unevaluatedProperties === false;
+    this.unevaluatedItemsFalse = schema.unevaluatedItems === false;
     this.hasUnevaluated = this.unevaluatedProperties !== undefined || this.unevaluatedItems !== undefined;
 
     // Custom keywords present on this node, in schema order. Each op holds
@@ -1183,7 +1188,14 @@ class Interpreter {
       if (P.unevaluatedProperties !== undefined && bits === T_OBJECT) {
         for (const key of Object.keys(data)) {
           if (local.props && local.props.has(key)) continue;
-          if (!this.eval(P.unevaluatedProperties, data[key], base, dynScope, errors, instancePath + '/' + escapePointer(key), schemaPath + '/unevaluatedProperties', stack, DISCARD)) valid = false;
+          if (P.unevaluatedPropertiesFalse) {
+            // The name is what is wrong, so the error names it and sits on the
+            // object holding it. Descending instead reported a false boolean
+            // schema at the member's own path, which says nothing about which
+            // key was unexpected and left `params` empty.
+            valid = false;
+            if (errors !== NOERRORS) errors.push(err('unevaluatedProperties', 'unevaluatedProperties', instancePath, schemaPath + '/unevaluatedProperties', { unevaluatedProperty: key }, 'must NOT have unevaluated properties'));
+          } else if (!this.eval(P.unevaluatedProperties, data[key], base, dynScope, errors, instancePath + '/' + escapePointer(key), schemaPath + '/unevaluatedProperties', stack, DISCARD)) valid = false;
           if (!local.props) local.props = new Set();
           local.props.add(key);
         }
@@ -1191,6 +1203,13 @@ class Interpreter {
       if (P.unevaluatedItems !== undefined && bits === T_ARRAY) {
         for (let i = 0; i < data.length; i++) {
           if (local.items && local.items.has(i)) continue;
+          if (P.unevaluatedItemsFalse) {
+            // One error for the array, not one per trailing element: what the
+            // array got wrong is its length past the last evaluated position.
+            valid = false;
+            if (errors !== NOERRORS) errors.push(err('unevaluatedItems', 'unevaluatedItems', instancePath, schemaPath + '/unevaluatedItems', { limit: i }, 'must NOT have more than ' + i + ' items'));
+            break;
+          }
           if (!this.eval(P.unevaluatedItems, data[i], base, dynScope, errors, instancePath + '/' + i, schemaPath + '/unevaluatedItems', stack, DISCARD)) valid = false;
           if (!local.items) local.items = new Set();
           local.items.add(i);

package/lib/js-compiler.js

@@ -35,6 +35,46 @@ function hoistOnce(ctx, key, code) {
   else if (ctx.helperCode) ctx.helperCode.push(code)
 }
 
+// Above this many declared names, asking whether a key is one of them by
+// testing it against each name in turn costs a comparison per name per key,
+// which is quadratic in the number of properties: a 1000-property schema with
+// `additionalProperties: false` spent 75 us where the same schema without the
+// keyword took 3, and doubling the properties quadrupled that. Below this many
+// the two are the same within noise and the chain allocates nothing, so it
+// stays. Cross-process medians, one variant per process, properties of type
+// string: 3 to 100 names are a tie; 250 names 8.76 us against 5.49, 500 26.29
+// against 12.47, and with no per-property work 2000 names 273 against 49.
+const AP_LOOKUP_MIN = 128
+
+// A name set built once per compiled function rather than once per call, as
+// source text so the standalone output carries it the same way. A null
+// prototype means a key called `toString` is not a member by accident, and a
+// plain property read measured faster than `Set#has` at every size tried.
+function emitNameLookup (ctx, names) {
+  const id = `_apn${ctx.varCounter++}`
+  const list = names.map((n) => JSON.stringify(n)).join(',')
+  const decl = `const ${id}=Object.create(null);for(const _apx of [${list}])${id}[_apx]=1`
+  if (ctx.preamble) ctx.preamble.push(decl)
+  else if (ctx.helperCode) ctx.helperCode.push(decl)
+  else return null
+  return id
+}
+
+// "every own key of `v` is one of `names`", as a `return false` check. A
+// hoisted lookup above the crossover, the comparison chain below it.
+function apMembershipCheck (ctx, names, v) {
+  if (names.length >= AP_LOOKUP_MIN) {
+    const id = emitNameLookup(ctx, names)
+    if (id !== null) {
+      // An indexed loop over `Object.keys`, not `for...in`: it allocates the key
+      // array but measured faster at every size tried, by about a quarter.
+      const i = ctx.varCounter++
+      return `var _apk${i}=Object.keys(${v});for(var _api${i}=0;_api${i}<_apk${i}.length;_api${i}++)if(${id}[_apk${i}[_api${i}]]===undefined)return false`
+    }
+  }
+  return `for(var _k in ${v})if(${names.map((k) => `_k!==${JSON.stringify(k)}`).join('&&')})return false`
+}
+
 function emitDeq(ctx) {
   hoistOnce(ctx, '_deqHoisted', DEQ_HELPER)
   return '_deq'
@@ -2147,7 +2187,7 @@ function genCode(schema, v, lines, ctx, knownType) {
       ? (propCount <= 15
           ? `var _n=0;for(var _k in ${v})_n++;if(_n!==${propCount})return false`
           : `if(Object.keys(${v}).length!==${propCount})return false`)
-      : `for(var _k in ${v})if(${Object.keys(schema.properties).map(k => `_k!==${JSON.stringify(k)}`).join('&&')})return false`
+      : apMembershipCheck(ctx, Object.keys(schema.properties), v)
         _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
   }
 
@@ -2572,8 +2612,14 @@ function genCode(schema, v, lines, ctx, knownType) {
           }
           // else: already emitted early (before properties)
         } else if (propCount > 0) {
-          // TRICK 3: charCodeAt switch tree
-          inner = genCharCodeSwitch(knownKeys, v)
+          // TRICK 3: charCodeAt switch tree. Above the lookup threshold it is
+          // the additionalProperties quadratic wearing a disguise: keys that
+          // share a first character, ENV_0 through ENV_999 say, all land in
+          // one case whose body is a chain of every name, per key of the
+          // document. The hoisted name lookup is the same cure it was there.
+          inner = propCount >= AP_LOOKUP_MIN
+            ? apMembershipCheck(ctx, knownKeys, v)
+            : genCharCodeSwitch(knownKeys, v)
                     _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
         } else {
           inner = `for(var _k in ${v})return false`
@@ -2587,8 +2633,13 @@ function genCode(schema, v, lines, ctx, knownType) {
         genCode(schema.unevaluatedProperties, `${v}[${ukVar}]`, subLines, ctx)
         if (subLines.length > 0) {
           const check = subLines.join(';')
-          const keyChecks = knownKeys.map(k => `${ukVar}===${JSON.stringify(k)}`).join('||')
-          const skipKnown = knownKeys.length > 0 ? `if(${keyChecks})continue;` : ''
+          let skipKnown = ''
+          if (knownKeys.length >= AP_LOOKUP_MIN) {
+            const id = emitNameLookup(ctx, knownKeys)
+            skipKnown = id !== null ? `if(${id}[${ukVar}]!==undefined)continue;` : `if(${knownKeys.map(k => `${ukVar}===${JSON.stringify(k)}`).join('||')})continue;`
+          } else if (knownKeys.length > 0) {
+            skipKnown = `if(${knownKeys.map(k => `${ukVar}===${JSON.stringify(k)}`).join('||')})continue;`
+          }
           const inner = `for(var ${ukVar} in ${v}){${skipKnown}${check}}`
                     _deferOrInline(ctx, lines, v, isObj ? inner : `if(typeof ${v}==='object'&&${v}!==null&&!Array.isArray(${v})){${inner}}`)
         }

package/lib/plan-compiler.js

@@ -894,6 +894,27 @@ function install(deps) {
     // unevaluated*: run last, against the annotations of everything above.
     if (P.unevaluatedProperties !== undefined) {
       const fn = child(P.unevaluatedProperties);
+      if (fn === FALSE_PAIR) {
+        // `false` rejects the member outright, and what is wrong is the name.
+        // Running the boolean schema against the value instead reported a
+        // false schema at the member's own path with empty params, which does
+        // not say which key was unexpected. The error belongs to this keyword,
+        // on the object holding the key, and it carries the key.
+        steps.push((data, errors, instancePath, schemaPath, stack, rec) => {
+          if (dataBits(data) !== T_OBJECT) return true;
+          let ok = true;
+          const keys = keysOf(rec, data);
+          for (let k = 0; k < keys.length; k++) {
+            const key = keys[k];
+            if (hasProp(rec, key)) continue;
+            ok = false;
+            if (errors === NOERRORS) return false;
+            errors.push(err('unevaluatedProperties', 'unevaluatedProperties', instancePath, schemaPath + '/unevaluatedProperties', { unevaluatedProperty: key }, 'must NOT have unevaluated properties'));
+            addProp(rec, key);
+          }
+          return ok;
+        });
+      } else {
       steps.push((data, errors, instancePath, schemaPath, stack, rec) => {
         if (dataBits(data) !== T_OBJECT) return true;
         let ok = true;
@@ -909,6 +930,7 @@ function install(deps) {
         }
         return ok;
       });
+      }
       if (fn === FALSE_PAIR) {
         // Every key must already be evaluated; on success there is nothing
         // new to record.
@@ -936,6 +958,21 @@ function install(deps) {
     }
     if (P.unevaluatedItems !== undefined) {
       const fn = child(P.unevaluatedItems);
+      if (fn === FALSE_PAIR) {
+        // One error for the array rather than one per trailing element: what
+        // the array got wrong is its length past the last evaluated position.
+        steps.push((data, errors, instancePath, schemaPath, stack, rec) => {
+          if (dataBits(data) !== T_ARRAY) return true;
+          for (let i = 0; i < data.length; i++) {
+            if (hasItem(rec, i)) continue;
+            if (errors !== NOERRORS) errors.push(err('unevaluatedItems', 'unevaluatedItems', instancePath, schemaPath + '/unevaluatedItems', { limit: i }, 'must NOT have more than ' + i + ' items'));
+            if (data.length > rec.n) rec.n = data.length;
+            return false;
+          }
+          if (data.length > rec.n) rec.n = data.length;
+          return true;
+        });
+      } else {
       steps.push((data, errors, instancePath, schemaPath, stack, rec) => {
         if (dataBits(data) !== T_ARRAY) return true;
         let ok = true;
@@ -949,6 +986,7 @@ function install(deps) {
         if (data.length > rec.n) rec.n = data.length;
         return ok;
       });
+      }
       if (fn === FALSE_PAIR) {
         vsteps.push((data, stack, rec) => {
           if (dataBits(data) !== T_ARRAY) return true;

package/lib/strict-check.js

@@ -0,0 +1,142 @@
+'use strict';
+
+// The authoring-time check behind `strictSchema`. A mistyped keyword is the
+// one schema mistake that fails open: `maxLenght` is not an error to any
+// JSON Schema dialect, it is an annotation, so the intended constraint is
+// simply absent and previously invalid data starts validating. A validator
+// cannot make that safe at validation time. It can be loud about it when the
+// schema is compiled, which is what this is.
+//
+// The known-keyword list is not written out here. Each vendored meta-schema's
+// `properties` are precisely its dialect's keywords, so the list comes from
+// the specification documents in `metaschemas.js` rather than from a copy
+// someone keeps in step. The union across vendored dialects is used, not the
+// schema's own dialect: a draft-07 keyword in a 2020-12 schema is a real
+// authoring question but not a fail-open one, and a union cannot produce a
+// false positive on a valid document.
+
+const { METASCHEMAS } = require('./metaschemas');
+const { levenshtein } = require('./levenshtein');
+
+// Keywords ata implements beyond the official vocabularies.
+const ATA_KEYWORDS = ['nullable', 'errorMessage', 'propertyDependencies', 'discriminator'];
+
+let SPEC_KEYWORDS = null;
+function specKeywords() {
+  if (SPEC_KEYWORDS === null) {
+    SPEC_KEYWORDS = new Set(ATA_KEYWORDS);
+    for (const doc of METASCHEMAS.values()) {
+      if (doc && doc.properties) for (const k of Object.keys(doc.properties)) SPEC_KEYWORDS.add(k);
+    }
+  }
+  return SPEC_KEYWORDS;
+}
+
+// Where subschemas live, so the walk knows a key under `properties` is a
+// property name and a key directly on a schema object is a keyword.
+const SCHEMA_MAPS = new Set(['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas']);
+const SCHEMA_LISTS = new Set(['allOf', 'anyOf', 'oneOf', 'prefixItems']);
+const SCHEMA_SINGLE = new Set([
+  'items', 'additionalItems', 'additionalProperties', 'unevaluatedProperties',
+  'unevaluatedItems', 'contains', 'propertyNames', 'not', 'if', 'then', 'else',
+  'contentSchema',
+]);
+// Values that are data, never schemas, however object-shaped they look.
+const DATA_VALUED = new Set(['enum', 'const', 'default', 'examples', 'required', 'type', '$vocabulary']);
+
+function nearest(word, known) {
+  let best = null;
+  let bestD = Infinity;
+  for (const k of known) {
+    // A candidate further away than half the word is noise, not a typo.
+    const d = levenshtein(word, k);
+    if (d < bestD) { bestD = d; best = k; }
+  }
+  return bestD > 0 && bestD <= 2 && best !== null ? best : null;
+}
+
+function resolveLocalPointer(root, ref) {
+  let node = root;
+  for (const raw of ref.slice(2).split('/')) {
+    const token = raw.replace(/~1/g, '/').replace(/~0/g, '~');
+    if (node === null || typeof node !== 'object') return false;
+    if (Array.isArray(node)) {
+      if (!/^\d+$/.test(token) || Number(token) >= node.length) return false;
+      node = node[Number(token)];
+    } else {
+      if (!Object.prototype.hasOwnProperty.call(node, token)) return false;
+      node = node[token];
+    }
+  }
+  return node !== undefined;
+}
+
+/**
+ * Walks a schema and reports the authoring mistakes the validator would
+ * otherwise ignore. Returns an array of { path, message }, empty when clean.
+ *
+ * `userKeywords` are names registered through the `keywords` option, and
+ * `x-` prefixed names pass without comment: they are the conventional
+ * extension namespace and rejecting them would flag real documents.
+ */
+function checkSchemaStrict(root, options) {
+  const known = specKeywords();
+  const user = options && options.userKeywords ? options.userKeywords : null;
+  const problems = [];
+  const seen = new Set();
+
+  function isKnown(key) {
+    if (known.has(key)) return true;
+    if (user && (Array.isArray(user) ? user.includes(key) : Object.prototype.hasOwnProperty.call(user, key))) return true;
+    if (key.startsWith('x-')) return true;
+    return false;
+  }
+
+  function walkSchema(node, path) {
+    if (node === null || typeof node !== 'object' || Array.isArray(node)) return;
+    if (seen.has(node)) return;
+    seen.add(node);
+    for (const key of Object.keys(node)) {
+      const value = node[key];
+      const at = path + '/' + key;
+      if (!isKnown(key)) {
+        const hint = nearest(key, known);
+        problems.push({
+          path: at,
+          message: hint
+            ? `unknown keyword "${key}" (did you mean "${hint}"?)`
+            : `unknown keyword "${key}"`,
+        });
+        continue;
+      }
+      if (key === '$ref' && typeof value === 'string' && value.startsWith('#/') && !resolveLocalPointer(root, value)) {
+        problems.push({ path: at, message: `$ref "${value}" does not resolve in this document` });
+        continue;
+      }
+      if (DATA_VALUED.has(key)) continue;
+      if (SCHEMA_MAPS.has(key)) {
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+          for (const name of Object.keys(value)) walkSchema(value[name], at + '/' + name.replace(/~/g, '~0').replace(/\//g, '~1'));
+        }
+      } else if (SCHEMA_LISTS.has(key)) {
+        if (Array.isArray(value)) for (let i = 0; i < value.length; i++) walkSchema(value[i], at + '/' + i);
+      } else if (SCHEMA_SINGLE.has(key)) {
+        // draft-07 lets `items` be an array of schemas.
+        if (Array.isArray(value)) { for (let i = 0; i < value.length; i++) walkSchema(value[i], at + '/' + i); }
+        else walkSchema(value, at);
+      } else if (key === 'dependencies') {
+        // draft-07: each value is either a schema or an array of names.
+        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+          for (const name of Object.keys(value)) {
+            if (!Array.isArray(value[name])) walkSchema(value[name], at + '/' + name);
+          }
+        }
+      }
+    }
+  }
+
+  walkSchema(root, '#');
+  return problems;
+}
+
+module.exports = { checkSchemaStrict };

package/lib/version.js

@@ -7,4 +7,4 @@
 //
 // Kept in lockstep with package.json by `tests/test_version_sync.js`.
 
-module.exports = '1.22.0';
+module.exports = '1.23.0';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ata-validator",
-  "version": "1.22.0",
-  "description": "JSON Schema validation with first-class TypeScript and zero runtime cost. AOT compile to per-schema ESM modules with zero validator dependency. Generic Validator<T> for TypeBox/Zod/Valibot composition. Optional runtime API. Standard Schema V1 compatible.",
+  "version": "1.23.0",
+  "description": "JSON Schema validation that compiles for speed and still runs where code generation is blocked. Compiled and interpreted engines answer identically at 100% of the official suite. TypeScript inference, Standard Schema V1, and a build step that emits dependency-free modules.",
   "main": "index.js",
   "module": "index.mjs",
   "types": "index.d.ts",
@@ -51,7 +51,7 @@
     "release:check": "node scripts/regen-safe-regex-source.js && node tests/test_pack_purity.js && node scripts/check-doc-coverage.js && node tests/test_error_codes_lock.js && node tests/test_safe_regex_source_sync.js && node tests/test_version_sync.js",
     "build": "cmake-js build --target ata",
     "rebuild": "cmake-js rebuild --target ata",
-    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_pattern_properties_errors.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
+    "test": "node test.js && node tests/test_removed_aot_methods.js && node tests/test_no_native.js && node tests/test_no_eval.js && node tests/test_property_dependencies.js && node tests/test_v1_dialect.js && node tests/test_buffer_path_parity.js && node tests/test_buffer_gate.js && node tests/test_buffer_reject_cost.js && node tests/test_nan_verdict.js && node tests/test_remove_additional_nested.js && node tests/test_exclusive_bounds.js && node tests/test_engine_differential.js && node tests/test_error_shape_differential.js && node tests/test_output_format.js && node tests/test_retry_message.js && node tests/test_describe_schema.js && node tests/test_aot_parse.js && node tests/test_draft7_semantics.js && node tests/test_metaschema_ref.js && node tests/test_pure_js_unsupported.js && node tests/test_native_load_order.js && node tests/test_pack_purity.js && node tests/test_make_native_package.js && node tests/test_browser_nofs.js && node tests/test_browser_imports_guard.js && node tests/test_version_sync.js && node tests/test_native_loaded.js && node tests/test_safe_regex_source_sync.js && node tests/test_t_builder.js && node tests/test_async_refine.js && node tests/test_safe_regex.js && node tests/test_safe_regex_integration.js && node tests/test_aot_build.js && node tests/test_aot_differential.js && node tests/test_aot_cli_build.js && node tests/test_aot_cli_smoke.js && node tests/test_bundle_standalone.js && node tests/test_standalone_anyof.js && node tests/test_standalone_formats.js && node tests/test_aot_format_mode.js && node tests/test_aot_additional_props_errors.js && node tests/test_id_anchor_refs.js && node tests/test_engine_routing.js && node tests/test_compile_cache_order.js && node tests/test_engine_diagnostic.js && node tests/test_format_engine_parity.js && node tests/test_uri_helper_parity.js && node tests/test_formats_single_pass.js && node tests/test_format_single_error.js && node tests/test_defs_pointer_alias.js && node tests/test_cross_doc_root_ref.js && node tests/test_codegen_entrypoint_agreement.js && node tests/test_hybrid_agreement.js && node tests/test_codegen_edge_shapes.js && node tests/test_ajv_errors.js && node tests/test_custom_keywords.js && node tests/test_strict_schema.js && node tests/test_aot_external_checks.js && node tests/test_ajv_parity.js && node tests/test_user_format_error_path.js && node tests/test_unevaluated_error_path.js && node tests/test_unevaluated_error_shape.js && node tests/test_pattern_properties_errors.js && node tests/test_additional_properties_scaling.js && node tests/test_no_input_mutation.js && node tests/test_typed_validator_runner.js && node tests/test_define_schema.js && node tests/test_error_codes_lock.js && node tests/test_error_code_lookup.js && node tests/test_error_order.js && node tests/test_error_order_ordinal.js && node tests/test_rejection_shape.js && node tests/test_lazy_normalization.js && node tests/test_value_equality.js && node tests/test_vocabulary.js && node tests/test_schema_scan.js && node tests/test_lazy_errors.js && node tests/test_lazy_instance.js && node tests/test_cyclic_input.js && node tests/test_native_error_codes.js && node tests/test_verdict_preprocess.js && node tests/test_plan_compiler.js && node tests/test_nullable.js && node tests/test_validate_and_parse.js && node tests/test_validate_data.js && node tests/test_enrich_error.js && node tests/test_enrich_received.js && node tests/test_rich_errors_optout.js && node tests/test_error_messages.js && node tests/test_source_positions.js && node tests/fuzz_positions.js && node tests/test_malformed_json_termination.js && node tests/test_data_positions.js && node tests/test_render_shared.js && node tests/test_renderers.js && node tests/test_additive_fields.js && node tests/test_diagnostic_source.js && node tests/test_diagnose.js && node tests/test_correlate.js && node tests/test_diagnostics_score.js && node tests/test_runtime_error_dx.js && node tests/test_aot_error_dx.js && node tests/test_abort_early.js && node tests/test_branch_collapse.js && node tests/test_suggestions.js && node tests/test_cli_validate.js && node tests/test_cli_version.js && node benchmark/bench_aot_size.mjs",
     "bench:size": "node benchmark/bench_aot_size.mjs",
     "test:suite": "node tests/run_suite.js && node tests/run_suite.js draft7 && node tests/run_suite.js v1",
     "test:compat": "node tests/test_compat.js",
@@ -122,13 +122,13 @@
     "LICENSE"
   ],
   "optionalDependencies": {
-    "@ata-validator/native-darwin-arm64": "1.22.0",
-    "@ata-validator/native-darwin-x64": "1.22.0",
-    "@ata-validator/native-linux-arm64-gnu": "1.22.0",
-    "@ata-validator/native-linux-arm64-musl": "1.22.0",
-    "@ata-validator/native-linux-x64-gnu": "1.22.0",
-    "@ata-validator/native-linux-x64-musl": "1.22.0",
-    "@ata-validator/native-win32-x64": "1.22.0"
+    "@ata-validator/native-darwin-arm64": "1.23.0",
+    "@ata-validator/native-darwin-x64": "1.23.0",
+    "@ata-validator/native-linux-arm64-gnu": "1.23.0",
+    "@ata-validator/native-linux-arm64-musl": "1.23.0",
+    "@ata-validator/native-linux-x64-gnu": "1.23.0",
+    "@ata-validator/native-linux-x64-musl": "1.23.0",
+    "@ata-validator/native-win32-x64": "1.23.0"
   },
   "peerDependencies": {
     "yaml": "^2.0.0"